The state of Indiana has sued credit bureau Equifax for a 2017 data breach that left 147.9 million Americas, including 3.9 million Hoosiers, compromised.

The breach happened between May 13, 2017, and July 30, 2017. The credit-monitoring company said at the time that “criminals” exploited a U.S. website application to access files, a high-tech heist that exposed sensitive information like Social Security numbers, birth dates, addresses and, in some cases, driver’s license numbers.

In the wake of the data breach, Equifax established a website where people could check to see if their personal information was stolen, and Experian offered free credit monitoring to all U.S. consumers for a year.

An investigation by the U.S. House of Representatives Committee on Oversight and Government Reform found the breach was “entirely preventable.”

The state argued in its lawsuit that Equifax used cost-cutting measures like outsourcing mission-critical systems. The company failed to improve security and instead chose to increase revenue, the lawsuit argued.

“Data breaches such as this one cause real harm to real people,” said Attorney General Hill. “Hoosiers trust us to work hard every day to ensure their safety and security. This action against Equifax results from an extensive investigation, and we will continue our diligent efforts to protect consumers from illegal or irresponsible business activities.”

The suit requests a jury trial and seeks restitution for the “money unlawfully received from the aggrieved consumers harmed by the deceptive acts” as well as civil penalties.